Re: Fedora 25 GRUB security issue

2017-08-03 Thread Peter Jones
On Thu, Aug 03, 2017 at 10:21:43AM -0600, Chris Murphy wrote: > security@ and security-team@ have no meaningful activity in at least > the last 6 months so I'm posting this here. > > grub2 incorrectly initialises the boot_params from the kernel image > https://bugzilla.redhat.com/show_bug.cgi?id=1

Re: Fedora 25 GRUB security issue

2017-08-03 Thread Peter Robinson
On Thu, Aug 3, 2017 at 7:04 PM, Chris Murphy wrote: > On Thu, Aug 3, 2017 at 11:02 AM, Peter Robinson wrote: >> On Thu, Aug 3, 2017 at 5:21 PM, Chris Murphy wrote: >>> security@ and security-team@ have no meaningful activity in at least >>> the last 6 months so I'm posting this here. >> >> Have

Re: Fedora 25 GRUB security issue

2017-08-03 Thread Chris Murphy
On Thu, Aug 3, 2017 at 11:02 AM, Peter Robinson wrote: > On Thu, Aug 3, 2017 at 5:21 PM, Chris Murphy wrote: >> security@ and security-team@ have no meaningful activity in at least >> the last 6 months so I'm posting this here. > > Have you tried something as simple as reaching out to the maintai

Re: Fedora 25 GRUB security issue

2017-08-03 Thread Peter Robinson
On Thu, Aug 3, 2017 at 5:21 PM, Chris Murphy wrote: > security@ and security-team@ have no meaningful activity in at least > the last 6 months so I'm posting this here. Have you tried something as simple as reaching out to the maintainer of grub2? > grub2 incorrectly initialises the boot_params

Re: Fedora 25 GRUB security issue

2017-08-03 Thread Matthew Miller
On Thu, Aug 03, 2017 at 10:21:43AM -0600, Chris Murphy wrote: > However, Fedora 24 didn't get the fix before going EOL. And Fedora 25 > and Rawhide both still have this problem. And I think it needs > attention. I suppose this is mildly pedantic since I'd be shocked if it makes any difference here

Re: Fedora 25 GRUB security issue

2017-08-03 Thread Florian Weimer
On 08/03/2017 06:21 PM, Chris Murphy wrote: > However, Fedora 24 didn't get the fix before going EOL. And Fedora 25 > and Rawhide both still have this problem. And I think it needs > attention. Does this really matter? The signed binaries are out there, and I don't think we have revocation worki